Consent to data processing in chat

A chat collects a name, a phone number and the text of the conversation. So the rules that apply to a contact form apply to it too.

Live chat feels fleeting: you talk and forget. In practice it collects exactly what a contact form collects — a name, a phone number, sometimes an email, plus the conversation text and the page the person is writing from. Under GDPR that is personal data, and the same rules apply.

A checkbox before the first message

Consent is switched on in site settings: the checkbox appears before the customer’s first message, not after. Next to it goes a link to the privacy policy. The consent text is editable — better to write in your own words that the data is needed to answer the request than to leave a legal formula nobody reads.

What to collect and what not to

Contacts can be requested before the conversation: name and phone are mandatory, email is not. That is a deliberate trade-off: the longer the form, the fewer people complete it. Collect what you cannot answer without, and do not collect “just in case” — every extra field has to be stored, protected and deleted on request.

Where all of it lives

Conversations, contacts and metadata (page, language, time) are stored in the installation’s own database — on your server, not in someone else’s cloud. The dashboard is closed to indexing, visitor uploads sit in a separate folder, and PHP is not executed there. It is worth deciding in advance who on the team may read history: the roles in the dashboard allow that.

The right to erasure

A “delete my data” request is easier to honour when everything is in one place. A conversation is visible in the dashboard as a whole: messages, contacts, operator notes. Separately, agree internally on a retention period — keeping three-year-old chats “just in case” rarely makes sense.

Operator notes are data too

An internal note saying “difficult customer” is formally the same personal data and may end up in an export. The rule is simple: write notes you would not be ashamed to show the customer — facts about the task, not judgements about the person.

When the AI answers

If the AI responder is enabled, the conversation is sent to a Google model to generate the reply. That belongs in your privacy policy alongside the other processors. The model itself never asks the customer for documents or card details — its instructions forbid those questions.

What to put in the policy

A few honest points are enough: what the chat collects, why, how long it is kept, who has access and how to have it deleted. If external processors are involved — hosting, Telegram for operator notifications, a model for automated replies — they are listed in the same place. It is a short text and it removes most questions.

Do not turn consent into a barrier

Three checkboxes and a modal window before the first message will reliably reduce the number of requests. The working option is one checkbox with a link to the policy, and nothing more. Consent is needed where you collect contacts; for an anonymous “are you open on Saturday?” a link to the policy in the interface is enough.